If you're building MCP servers and publishing them to directories like Smithery or Glama, there's a good chance you're shipping code that could compromise your users' AI agents. Model Context Protocol servers essentially give large language models new superpowers—fetching data, reading files, querying databases—and with great power comes great responsibility you might not be thinking about.

Why MCP Server Security Is Different

Traditional application security assumes attackers are external. MCP flips that entirely: you're writing code that runs inside an AI agent's execution environment, trusted to handle sensitive contexts, make tool calls, and potentially access systems the user never intended to expose. A vulnerable or malicious MCP server doesn't just break your app—it can leak conversation history, exfiltrate data through network calls, or let a compromised LLM pivot into other systems.

The Smithery and Glama Problem

Smithery and Glama have emerged as the go-to directories for discovering and sharing MCP servers—think npm registries but specifically for AI tooling. Both platforms make it trivially easy to publish: fork a repo, add some config, push. There's no security gatekeeping, no vulnerability scanning by default, and users installing these servers often don't understand the trust model they're accepting.

What a Security Rating Should Cover

Before publishing any MCP server, you need to evaluate its attack surface honestly. Key questions: Does it make external network requests? Could it be tricked into calling unintended tools? Is sensitive data logged or transmitted anywhere unexpected? Does it handle user-controlled input safely when constructing tool calls? A proper security rating documents these concerns explicitly so users can make informed decisions.

Practical Steps for Developers

Start by auditing what your server actually touches—file systems, environment variables, network endpoints. Add explicit permission scopes rather than asking for blanket access. Document which data leaves the user's environment and where it goes. Consider adding confirmation prompts for destructive operations. Your README isn't optional; it's the security contract with every user who installs your tool.

Key Takeaways

  • MCP servers run inside trusted execution contexts—security assumptions are different from normal apps
  • Smithery and Glama have no security gatekeeping at publish time
  • Audit network calls, file access, and data exfiltration paths before shipping
  • Explicit permission scopes beat broad access requests every time

The Bottom Line

The AI agent ecosystem is moving fast, but that speed doesn't excuse shipping MCP servers with the same careless security posture we've spent years cleaning up in web applications. Rate your server's risks honestly and document them clearly—your users' agents are trusting you with more than just code.